Manual App Registration for OneDrive Migration

Use this page when setting up the Microsoft Entra ID application registrations required by the current EdbMails OneDrive migration workflow. Create OneDrive Migration Source in the tenant that contains the OneDrive data to read, and create OneDrive Migration Target in the destination tenant where the migrated data will be written.

The steps below contain only the OneDrive-specific app names, permission lists and connection checks. Use the Microsoft Entra ID App Creation Guide for the shared Microsoft Entra tasks, then return to this page for the exact OneDrive Source or Target configuration.

Quick configuration summary

Before you configure the OneDrive apps

• Identify the Microsoft 365 tenant that contains the Source OneDrive data and the tenant that will receive it.
• Have the Microsoft 365 Global Administrator account information used for each OneDrive connection available.
• Keep the OneDrive Source app credentials together and keep the Target app credentials separately.
• Use the OneDrive Migration Source credentials only for the Source connection and the OneDrive Migration Target credentials only for the destination.
• Complete all permissions for the selected OneDrive app before granting admin consent in that tenant.

Steps to manually register an app for OneDrive Migration

Click the Source OneDrive app and Target Source OneDrive app accordions below based on the tenant you are configuring.

1. Source OneDrive app

   1. Create the Source OneDrive app

   Create the application in the Source tenant. Enter the application name as OneDrive Migration Source.

    Click here to know the steps to create the app in Microsoft Entra ID.

   2. Create the Source client secret

   Create a client secret for OneDrive Migration Source. Copy the Client Secret Value when it is displayed and keep it with the Source application details.

    Click here to know the steps to create a client secret.

   3. Add Source OneDrive permissions

   Set all these permissions in the OneDrive Migration Source app.

   API: Microsoft GraphPermission type: Application permissions

   • Files.Read.All
   • Group.Read.All
   • GroupMember.Read.All
   • Sites.Read.All
   • User.Read.All

   After selecting the five OneDrive Source permissions, grant admin consent for the Source app.

    Click here to know steps to add Application permissions and grant admin consent.

2. Target OneDrive app

   1. Create the Target OneDrive app

   Create the application in the Target tenant. Enter the application name as OneDrive Migration Target.

    Click here to know the steps to create the app in Microsoft Entra ID.

   2. Create the Target client secret

   Create a separate client secret for OneDrive Migration Target. Copy and securely store its Client Secret Value.

    Click here to know the steps to create a client secret.

   3. Add Target OneDrive permissions

   Set all these permissions in the OneDrive Migration Target app.

   API: Microsoft GraphPermission type: Application permissions

   • Files.ReadWrite.All
   • Group.ReadWrite.All
   • GroupMember.ReadWrite.All
   • Sites.Create.All
   • Sites.FullControl.All
   • Sites.ReadWrite.All
   • User.Read.All

   After the seven OneDrive Target permissions are added, grant admin consent for the Target app.

    Click here to know steps to add Application permissions and grant admin consent.

Why the Source and Target OneDrive permission lists are different

The Source application is used to read the OneDrive data selected for migration. The Target application needs the permissions required to create or write data in the destination. Keep the two permission sets separate and verify the app name before adding permissions.

1. Connect the OneDrive tenants in EdbMails

   Source connection

   When connecting the Source OneDrive tenant in EdbMails, use the credentials created for OneDrive Migration Source. Keep the Application (Client) ID, Directory (Tenant) ID, Client Secret Value, and the Microsoft 365 administrator account information ready.

   Target connection

   When connecting the Target OneDrive tenant, use the corresponding credentials created for OneDrive Migration Target. The Client ID, Tenant ID and Client Secret Value must all belong to the Target app in the Target tenant.

   Do not mix credentials: Using a Source Client ID with a Target Tenant ID or Target Client Secret can prevent the OneDrive connection from authenticating correctly.

   For the complete OneDrive source connection, target connection, mapping and migration workflow, continue with the EdbMails OneDrive Migration Guide.

Verify the OneDrive app registration before connecting EdbMails

• OneDrive Migration Source is present in the Source Microsoft 365 tenant.
• Its Source configuration contains the five Microsoft Graph Application permissions listed in this guide.
• OneDrive Migration Target is present in the destination tenant.
• Its Target configuration contains the seven Microsoft Graph Application permissions listed in this guide.
• Admin consent is granted in the corresponding tenant for each completed OneDrive permission set.
• The Client ID, Tenant ID and Client Secret Value entered for a OneDrive connection all belong to the same app registration.

1. Troubleshooting manual app registration

   1. EdbMails cannot authenticate the OneDrive connection

      Verify the tenant being connected and compare its credentials with the matching OneDrive Migration Source or OneDrive Migration Target registration. The Client ID, Tenant ID and Client Secret Value must belong to that same app, and its permission list must have admin consent.

   2. The Target app still does not have the expected access

      Compare the Target app with all seven Microsoft Graph Application permissions listed on this page. Confirm that Sites.FullControl.All is added under Microsoft Graph and that admin consent is granted.

   3. The Source and Target app credentials were mixed

      Use only the credentials from OneDrive Migration Source for the Source connection and only the credentials from OneDrive Migration Target for the Target connection.

   4. I copied the Client Secret ID instead of the Client Secret Value

      OneDrive manual authentication requires the Client Secret Value. If only the Secret ID is available now, create a new secret in the relevant OneDrive app and copy its Value immediately.

1. Frequently asked questions

   1. Are the OneDrive permissions Application or Delegated permissions?

      Configure every permission in the OneDrive Source and Target lists as a Microsoft Graph Application permission.

   2. Do the Source and Target OneDrive apps use the same permissions?

      No. Use the five permissions shown under Source OneDrive app for the Source tenant and the seven permissions shown under Target OneDrive app for the destination tenant.

   3. Where should Sites.FullControl.All be added for the Target OneDrive app?

      Add Sites.FullControl.All under Microsoft Graph > Application permissions as part of the Target permission list shown on this page.

   4. Can I use the Source app details for the Target OneDrive tenant?

      No. Use the application registered in the tenant you are connecting. The Source and Target registrations and client secrets are separate.

   5. Does the Target OneDrive app require its own client secret?

      Yes. Create a client secret for OneDrive Migration Target and use that Client Secret Value with the Target app details.

   6. Where do I create the app and client secret?

      Use the Microsoft Entra ID App Creation Guide for the Entra app and client-secret steps. Use the OneDrive application name and permission set from this page when you reach those stages.

   7. Can I use this OneDrive permission list for SharePoint or Teams migration?

      No. Use the dedicated SharePoint, Teams and Channel, or Private and Group Chat manual-registration page for those workloads.

Related EdbMails resources

---

Additional resources:

• OneDrive Migration Tool
• OneDrive Migration Guide
• OneDrive Pre-Migration Planning
• OneDrive Migration Checklist